CVE-2026-92959: vm2 allowAsync bypass via Promise thenable assimilation

CVE-2026-92959 · Severity: high · CVSS 7.1 · Published 2026-09-17

vm2 is a JavaScript sandbox used to safely execute untrusted code with restricted capabilities. When the allowAsync option is set to false to prevent asynchronous code execution, an attacker can bypass this restriction using Promise static methods, allowing malicious code to continue executing after the sandbox returns control to the host and outside any configured timeout limits. This could enable code execution and resource exhaustion attacks against applications relying on vm2 for code isolation.

Technologies: vm2 (npm). Vendors: npm.

Quick answers

Is CVE-2026-92959 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92959 being exploited in the wild.
How severe is CVE-2026-92959?
High severity, with a CVSS score of 7.1, published 17 September 2026.
Which products and versions are affected?
vm2 (npm) <= 3.11.7, SEMVER:introduced=0,fixed=3.11.8.
Is there a fix for CVE-2026-92959?
Yes. vm2 (npm): upgrade to 3.11.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92959 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-92959?
Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vm2 (npm): upgrade to 3.11.8 or later
    npm install vm2@3.11.8

Technical details

The vulnerability is a protection mechanism bypass (CWE-693) in vm2's async restriction enforcement. While vm2 blocks direct use of Promise.prototype.then when allowAsync is false by replacing it with a handler that throws an error, it fails to validate thenable objects passed to Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, Promise.allSettled). When these methods assimilate attacker-controlled thenables, native Promise resolution triggers PromiseResolveThenableJob, which invokes the attacker's then method asynchronously in a microtask without passing through the patched then handler. This allows sandboxed code to schedule execution that occurs after VM.run() or NodeVM.run() returns, bypassing both the async restriction and the configured execution timeout. No user interaction is required; the vulnerability is reachable through direct API misuse with allowAsync: false. Patched in vm2 version 3.11.8.

Affected products

  • patriksimek vm2 before 3.11.8

Identifiers

  • CVE-2026-92959
  • GHSA-f8gf-w286-fmq2

Timeline

  • 2026-08-27: disclosed: GitHub Security Advisory GHSA-f8gf-w286-fmq2 published
  • 2026-09-17: advisory: CVE-2026-92959 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.